In the computer security field, “intrusion” is a broad term encompassing many undesirable activities. The objective of an intrusion may be to acquire information that a person is not authorized to have (referred to as “information theft”), it may be to cause business harm by rendering a network, system, or application unusable (referred to as “denial of service”) and/or, it may be to gain unauthorized use of a system as a stepping stone for further intrusions elsewhere. Intrusions can follow a pattern of information gathering, attempted access, and then destructive attacks.
Some intrusions can be detected and neutralized by the target system, although often not in real time. Other intrusions may not be effectively neutralized by the target system. Intrusions can also make use of “spoofed” packets which are not easily traceable to their true origin. Many intrusions now make use of unwitting accomplices—that is, machines or networks that are used without authorization to hide the identity of the intruder. For these reasons, detecting attempts at information gathering, access attempts, and intrusion accomplice behaviors can be an important part of intrusion detection.
Intrusions can be initiated against a host on an internal network by, for example, an intruder that is on an external network (e.g., internet) or from an intruder that is on the internal network. A firewall may provide some protection against intrusions from external networks. However, it may not prevent intrusions once the firewall has “approved” entry into the internal network, and it may not provide protection when the intrusion is initiated from inside the internal network.
An Intrusion Protection System (hereinafter, “IPS”) can provide protection from many types of intrusions. An IPS may include intrusion detectors that examine network traffic. Intrusion detectors may be placed at strategic points in networks, such in a firewall between an external network and an internal network, and/or on the internal network. Intrusion detectors may use “pattern matching” to try to match data communications on the network(s) against a known intrusion signature, or other rules that define when a data communication is to be deemed an intrusion.
Upon detecting an intrusion, the IPS may block a data communication from reaching an intended destination device. The IPS may also block subsequent data communications from the device that was the source of the communication identified.
Defining rules under which an IPS identifies and blocks communications can be a challenging trade-off. Rules with high levels/low thresholds for detecting intrusions may be more likely to block intrusions, but may also be more likely to block valid communications. In contrast, rules with low detection levels/high thresholds may avoid blocking valid communications, but may also increase the number of intrusions that are not blocked.
Some valid communications may be blocked without substantially harming the destination device or a user thereof, such as blocking some email messages. However, blocking other valid communications may cause the source and/or destination device to malfunction. For example, blocking data packets in a bi-directional video conference or an interactive game may cause the associated applications on the communication devices to malfunction. Accordingly, an IPS that blocks valid data communications and/or allows intrusion can negatively affect the operation of the associated communication devices.